MALICIOUS — 9f631fd65d36da577660192ab36861ed99c2acfb2aa10f8cf01ecb38339b3c9b

MALICIOUS — 9f631fd65d36da577660192ab36861ed99c2acfb2aa10f8cf01ecb38339b3c9b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fileinfector family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 9f631fd65d36da577660192ab36861ed99c2acfb2aa10f8cf01ecb38339b3c9b
SHA-1: 6dd5b5bd515dded2d587e487e514b5e4d984c79e
MD5: 35c15a4f7c17cc5b7e1f1b1a6af6198f
imphash: 895fbb56c02c3d2bca3125cef5da8730
ssdeep: 3072:v15Jt5EsmcLMt015Jt5EsmcLMt015Jt5EsmcLMtW+W2Y3:t5hZl5hZl5hZr+W2Y3
TLSH: T1A14090C531953B10EDF4F858ED04EC2CB15389A622362BD8A402D53F74B97F706A986E
Submitted as: 9f631fd65d36da577660192ab36861ed99c2acfb2aa10f8cf01ecb38339b3c9b
File type: pe · Size: 171626 bytes
Verdict: malicious (100/100) · Family: Fileinfector

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Fileinfector-9831963-0
Detect It Easy (packer/type): DIE:MinGW
Microsoft Defender: Trojan:Win32/Vindor!pz
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Malware.Fileinfector-9831963-0 (rule Win.Malware.Fileinfector-9831963-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 15 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MinGW (rule DIE:MinGW) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, MinGW - static signal, weight 0.25, confidence 0.55
Dropped 23 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

94494 behavior events · 2 ATT&CK techniques · 38 dropped files.

Dropped files

C:\Windows\lsasetup.log - 1de67a6d214f5524682c985e5abb6753d03a0520c0213d0bb366ba3331a50e90
C:\Windows\System32\opencl.dll - c70483f92e8fa8f52a12307a1a45dc854e98e78c5c9b8cc1c10000951b7f5b57
C:\exc.exe - 447d4da47870765081923f3caa8ddd8eb81866ce4e1b34a7658998d52ceec663
C:\Windows\System32\mfcm140.dll - 92dd874fd489de6e63b6b102cd94f4026c22eec9345fab968bcb9d8428d40fb1
C:\Windows\System32\mfc140.dll - 2bae7c19f43037b747f7d5ef4a4469612d84e2630138947fb78cc0e3bd14b8ce
C:\Windows\System32\debug.log - 9bed581a3d7eeacdd5df97cfa163ff75be94efd8503ae8dd1e69160ff1deefb4
C:\Windows\WindowsUpdate.log - dc99c9a3a4eb35fd05d95ccdbfbdfd0a7a3d8e7ae7d254ed1b1b4c37d4b296db
C:\Windows\System32\mfcm140u.dll - de787942c54010a00dca4d2da6d50263fb78e1043642f257ce09151b1fd9c85b
C:\Windows\setuperr.log - 38c948f28abcf06f7e80155c816fb14893036a5665d9991124f1e0a6512a5052
C:\Windows\SysmonDrv.sys - 78dd94b2273785f70f01c7d2e501b0eb04591b7bdecdd5ec1ad59d4e1db75757
C:\Windows\pyw.exe - 0480a216a93f32ffc31398bc5e1512ef2dd82b870f3ced0c9ae034b91a50dbc3
C:\Windows\py.exe - e1b49dafff2411969aea3771077cb69a10162d0da43707573a3847cd8b822583
C:\Windows\System32\msvcp140_codecvt_ids.dll - 16cacc5afe4490b806402ea907a13b2edf3180455553797f751c0a7ac71f5ed6
C:\Windows\System32\msvcp140_2.dll - 2ceb662bfad449aa2a65af928b0d3bf76412f7338439dab389d3825a65481a65
C:\Windows\System32\vulkan-1.dll - 9b68ab17ccbdb6edc9e1ccd0d7971038543947cc7e84ecf1b82dae75f9648ef8

Embedded URLs

http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0O
http://office.microsoft.com
http://www.pinkworld.com
http://www.youporn.com
http://www.redtube.com
http://www.assparade.com/
http://www.freeav.com/
http://www.antispyware.com/
http://www.antivirus.com/
http://www.ticrf.org.tw/chinese/html/06-rating-1.htm
http://www.ticrf.org.tw/chinese/html/06-rating-v11.htm
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
www.pinkworld.com
www.youporn.com
www.redtube.com
www.assparade.com
www.freeav.com
www.antispyware.com
www.antivirus.com
www.ticrf.org.tw
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.18
20.247.184.197
52.123.252.225
104.18.33.89
4.230.171.124
135.233.45.221
4.150.223.99
13.69.116.107
135.233.45.222
40.84.85.40
92.223.78.30
52.110.12.21
52.148.114.188
72.153.5.61

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report